FlowerStorm is a Phishing-as-a-Service platform that emerged after the decline of Rockstar2FA, using Adversary-in-the-Middle attacks to steal Microsoft 365 credentials and bypass multi-factor authentication. Darktrace detected suspicious login activities linked to FlowerStorm, enabling early mitigation of the threat through autonomous response actions. #FlowerStorm #Rockstar2FA #Microsoft365 #Darktrace
Keypoints
- FlowerStorm is a PhaaS platform that gained traction following the decline of Rockstar2FA, sharing similar phishing techniques and infrastructure.
- Both platforms use fake Microsoft login pages to harvest credentials and MFA tokens via Adversary-in-the-Middle attacks.
- FlowerStorm’s phishing pages employ plant-themed HTML titles and use backend servers on .ru, .moscow, .com domains, and Cloudflare services.
- Darktrace identified anomalous Microsoft 365 login activities involving rare external IPs, notably 69.49.230[.]198, associated with FlowerStorm.
- Attackers used harvested credentials to perform privilege escalation actions, such as password resets within Azure Active Directory.
- Darktrace recommended Autonomous Response actions like disabling user accounts and blocking IPs to contain the threat effectively.
- Early detection and response by Darktrace prevented attackers from advancing their privileges in the targeted SaaS environment.
MITRE Techniques
- [T1078.004] Valid Accounts: Cloud Accounts – Use of stolen Microsoft 365 credentials for unauthorized access (‘…accessing a Software-as-a-Service (SaaS) account from several rare external IP addresses…’).
- [T1538] Account Discovery: Cloud Service Dashboard – Observation of attacker activity in SaaS environment to identify account settings (‘…SaaS user resetting the password on the Core Directory of the Azure Active Directory…’).
- [T1586] Compromise Accounts: Resource Development – Phishing platform creation and use to harvest credentials (‘…FlowerStorm platform focuses on credential harvesting using fields such as email, pass, and session tracking tokens…’).
- [T1539] Steal Web Session Cookie: Credential Access – Theft of session tokens to bypass MFA (‘…supporting MFA authentications via their backend systems… enabling bypass of MFA and stealing session tokens.’)
Indicators of Compromise
- [IP Address] Malicious source IP linked to FlowerStorm activity – 69.49.230[.]198
- [File Name] Backend communication file used by FlowerStorm phishing pages – next.php
- [Domain] Phishing infrastructure domains including .ru, .moscow, .com TLDs, and Cloudflare-hosted pages such as pages[.]dev
Views: 45